Managing software distribution for regulatory compliance

ABSTRACT

A computer-implemented system is provided for distributing product updates to end user medical devices. An update interface residing on a distribution platform is configured to distribute product updates and maintain a log of such distributions in an audit database. A configuration device in data communication with the update interface registers itself with the update interface and downloads product updates from the update interface, such that the registration includes providing identifying information for a user of the configuration device and identifying information for the configuration device. A medical device in data communication with the configuration device registers itself with the configuration device and downloads a particular product update from the configuration device, such that the configuration device creates a record of the particular product update and communications the record of the particular product update to the update interface. In this way, product updates distributed via the configuration device are recorded and tracked for regulatory purposes.

FIELD

The present disclosure relates generally to a digital distributionplatform and, more particularly, to a distribution platform thatdistributes and tracks product updates through an intermediary forregulatory compliance.

BACKGROUND

Increasingly, the healthcare industry is turning to portable electronicmedical devices to assist with care of patients. For example, a diabetespatient may use a blood glucose meter, an insulin pump, and/or acontinuous glucose meter as part of the patient's medical treatment.Each of these devices is configured with suitable software for operatingthe device. When the software needs updating, the patient wastraditionally required to send the device to the device manufacturer.The device manufacturer would in turn install new versions of thesoftware on the medical device and return the updated device back to thepatient. In other situations, a device manufacturer might send acomputer readable disk which contains updated versions of the softwareto either the patient or their healthcare provider. The disk could thenbe used to update the software on the medical device. Each of theseapproaches has drawbacks but is in part mandated to ensure that devicescomply with government regulations.

Thus, there is a need for a more seamless manner for updating softwareresiding on portable medical devices that is compliant with applicablegovernment regulations. Given the interactions between patients andtheir healthcare providers, it may be preferable for product updates tobe administered by healthcare providers. In such cases, theinfrastructure should support the distribution of product updatesthrough an intermediary such as the healthcare provider.

This section provides background information related to the presentdisclosure which is not necessarily prior art.

SUMMARY

In one aspect the present disclosure, a computer-implemented system isprovided for distributing product updates to end user medical devices.An update interface residing on a distribution platform is configured todistribute product updates and maintain a log of such distributions inan audit database. A configuration device in data communication with theupdate interface registers itself with the update interface anddownloads product updates from the update interface, such that theregistration includes providing identifying information for a user ofthe configuration device and identifying information for theconfiguration device. A medical device in data communication with theconfiguration device registers itself with the configuration device anddownloads a particular product update from the configuration device,such that the configuration device creates a record of the particularproduct update and communications the record of the particular productupdate to the update interface. In this way, product updates distributedvia the configuration device are recorded and tracked for regulatorypurposes.

In another aspect of the disclosure, a method is provided fordistributing product updates through an intermediary to end user medicaldevices. The method includes: registering a configuration applicationresiding on an intermediary configuration device with an updateinterface of a distribution server, wherein the registration of theconfiguration device includes identifying information for a user of theconfiguration device and identifying information for the configurationdevice; downloading a product update from the update interface to theconfiguration device; registering a given medical device with theconfiguration application, wherein the registration includes identifyinginformation for the given medical device; distributing the productupdate from the configuration device to the given medical device;creating a record of the product update to the medical device at theconfiguration device; and communicating the record of the product updatefrom the configuration device to the update interface.

This section provides a general summary of the disclosure, and is not acomprehensive disclosure of its full scope or all of its features.Further areas of applicability will become apparent from the descriptionprovided herein. The description and specific examples in this summaryare intended for purposes of illustration only and are not intended tolimit the scope of the present disclosure.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram depicting an exemplary digital distribution platformfor distributing product updates to end user medical devices;

FIG. 2 is a diagram depicting an exemplary construct for thedistribution server;

FIG. 3 is a diagram depicting an exemplary method for distributingproduct updates through an intermediary using the digital distributionplatform;

FIG. 4 is a diagram depicting an exemplary method by which aconfiguration application retrieves product updates from thedistribution server;

FIG. 5 is a diagram of an exemplary data model for the distributiondatabase;

FIG. 6 is a diagram of an exemplary data model for the audit database;

FIG. 7 is a diagram depicting an exemplary construct for theconfiguration device;

FIG. 8 is a diagram depicting an exemplary method for distributingproduct updates from the configuration device to one or more end userdevices;

FIG. 9 is a diagram illustrating an exemplary use case for distributingproduct updates from a configuration device; and

FIG. 10 is a flowchart depicting an exemplary method for distributingproduct updates which accounts for dependencies amongst devices.

The drawings described herein are for illustrative purposes only ofselected embodiments and not all possible implementations, and are notintended to limits the scope of the present disclosure. Correspondingreference numerals indicate corresponding parts throughout the severalviews of the drawings.

DETAILED DESCRIPTION

FIG. 1 depicts an exemplary digital distribution platform 10 fordistributing product updates to handheld medical devices such a bloodglucose meter or an insulin pump. The distribution platform 10 iscomprised generally of: an update source 12, a distribution server 14, aconfiguration device 16 and one or more medical devices 18. Each of thecomponents is further described below. While the following descriptionis provided with reference to medical devices, it is readily understoodthat the concepts disclosed herein are applicable more generally toother types of portable consumer electronic devices.

The update source 12 enables users to publish or otherwise makeavailable product updates for medical devices 18 via the distributionserver 14. Product updates are files that contain updates for a device.For example, a product update can be an update to a softwareapplication, firmware, a language file, and/or a database residing onthe device. Product updates can also encompass updates to deviceparameters, user documentation or other types of data files. Other typesof product updates are also contemplated by this disclosure. In anexemplary embodiment, the update source 12 is further defined as adesktop personal computer or some other computing device having accessover a network to the distribution server 14.

FIG. 2 further illustrates an exemplary construct for the distributionserver 14. The distribution server 14 includes a publishing portal 22,an update interface 24, a distribution database 26 and an audit database28. The publishing portal 22 provides an interface to publish productupdates. In an exemplary embodiment, the portal 22 may be one or moreweb pages accessible by the update source 12. Publishers of productupdates may use the portal 22 to configure the parameters associatedwith the product update. For example, the publisher may specify one ormore countries for which the product update is to be available. Inanother example, the publisher may specify conditions or dependencieswhich must be meet to install the product update. The portal 22 thenpublishes the product update by creating an entry for the product updatein the distribution database 26. Further details regarding an exemplarypublishing portal 22 may be found in U.S. Patent Application entitled“Remote Configuration and Selective Distribution of Product Content toMedical Device” filed concurrently herewith and incorporated herein byreference.

FIG. 5 depicts exemplary data model for how the distribution database 26could be constructed. Of note, the data model supports definingdependencies between products (i.e., applications) as well as devices.Dependencies are used in order to determine if a product is capable ofbeing updated as further described below.

More specifically, the data model includes an application updateattribute element 51 and a device update attribute element 52. Theapplication update attribute element 52 includes foreign keys relatingthe application update attribute element 52 to an application updateelement 53 and an attribute type element 55. Similarly, a device updateattribute element 52 has foreign keys relating the update attributeelement 52 to a device update element 54 and the attribute type element55. The attribute type 55 stores an attribute type and include a foreignkey that relates the attribute type 55 to a package type element 56.Examples of attribute types include a version, a document type or avideo codec.

The data model further includes an application dependency element 57 anda device dependency element 58. The application dependency element 57has a primary key indicating a dependency identifier for theapplication, and foreign keys that relate an application dependencyelement 57 to the application update element 53 and a dependency typeelement 59. Similarly, the device dependency element 58 includes aprimary key indicating a dependency identifier, as well as foreign keysthat relate a device dependency element 58 to a device update element 54and a dependency type element 59. Both the application dependencyelement 57 and the device dependency element 58 can include a key thatreferences a region element 61 or another update id.

The dependency type element 59 defines a type of dependency. Examples ofdependency types include a device-to-device dependency, meaning that anupdate or action must be performed on one device in order for an updatecan be applied to another device. Another example of a dependency typeis an application-to-application, meaning that an update or action mustbe performed on one application in order for a requested update to beapplied to another application. The dependency types can also includedevice-to-application, language-to-region, regional dependencies, andother update dependencies.

The application update attribute element 51 and the applicationdependency element 54 both relate to the application update element 53.Similarly, the device update attribute element 52 and the devicedependency element 58 both point to the device update element 54. Theapplication update element 53 includes a primary key of an applicationupdate identifier and foreign keys that relate an application updateelement 53 to an application element 63 and to a package type element56. The application update element 53 can also store a location of anapplication update file corresponding to the update package, e.g. theURL of the application update file. The device update element 54includes a primary key indicating a device update identifier and foreignkeys that relate a device update element 54 to a device element and thepackage type element. The device update element 54 can also store alocation of a device update file corresponding to the update package.

Application update elements 53 relate to an application element 63 anddevice update elements 54 relate to a device element 64. The applicationelement 63 includes a primary key indicating an application identifier.The application element 63 can further store the product family membersof the application, including the products that the application canexecute on. The device element 64 includes a primary key that indicatesa device identifier and can further store a model and model number ofthe device.

The package type element 56 is referenced by the application updateelement 53, the device update element 54 and the attribute type element55. The package type element 56 includes a package type as a primarykey. Examples of package types include a software update, a firmwareupdate, a language update, a document update, and a database update. Theregion element 61 may be referenced by a dependency element 57 or 58.The region element can include a list of regions that an update isintended for. The regions can be countries, continents, geographicalregions, or another geographical division. It is appreciated that theforegoing is an exemplary structure of the distribution database 26. Itis appreciated that variations of the foregoing are contemplated andwithin the scope of this disclosure.

With continued reference to FIG. 2, the update interface 24 isconfigured to distribute product updates published in the distributiondatabase 26. When a requesting device queries the update interface 24for the latest versions of available product updates, the updateinterface 24 responds by querying the distribution database 26 andprovides a listing of available product updates to the requestingdevice. The update interface 24 may subsequently receive a request todownload a particular product update. In response to the downloadrequest, the update interface 24 will download the product update to therequesting device and maintain a record of the download in the auditdatabase 28. Each of these functions is further described below.

FIG. 3 illustrates an exemplary method for distributing product updatesthrough an intermediary using the digital distribution platform 10. Inan exemplary use case, product updates may be downloaded from thedistribution server 14 to an intermediary, such as a health careprovider. More specifically, the product updates are downloaded to aconfiguration application 30 residing on a configuration device 16associated with the health care provider. In an exemplary embodiment,the configuration device 16 is a desktop personal computer residing atthe office of the health care provider. The healthcare provider will inturn download product updates to the medical devices of their patients.To do so, patients will typically bring their medical devices with themwhen visiting their healthcare provider. The medical devices 18 cancommunicate either via a wired or wireless connection with theconfiguration device 16. For regulatory compliance, it is important tocapture information regarding the identity of the healthcare providerdistributing product updates as well as the identity of the medicaldevice receiving product updates.

Upon installation of a configuration application 30 on a configurationdevice 16 or sometime thereafter, the configuration application 30 willoperate to register itself with the update interface 24 provided by thedistribution server 14. Registration will include capturing informationat 31 that uniquely identifies the healthcare providing entityassociated with the configuration application, where a healthcareproviding entity is understood to be an individual, such as physician ora nurse, or a collection of individuals such as group medical practiceor a hospital. Exemplary identifying information for a healthcareprovider may include name, address, practitioner license number, and thelike. Registration will also include capturing information at 32 thatuniquely identifies the configuration application (i.e.,ApplicationInfo) and/or the configuration device. Exemplary identifyinginformation for a unique application may include the product family, anapplication identifier, a version number for the application currentlyinstalled as well as other types of identifying information. Suchidentifying information may be gathered by querying a user or some othersuitable method. Captured registration information will then becommunicated to and stored by the update interface 24. Once properlyregistered, the configuration application 24 can interface with theupdate interface 24 to retrieve product updates from the distributionserver 14.

In an exemplary embodiment, the configuration application 30 operates toretrieve product updates from distribution server 14 as shown in FIG. 4.Before querying the update interface for available updates, theconfiguration application may first authenticate at 41 with anauthenticating entity 40. The authentication entity may reside on aseparate distinct server or the distribution server. When successfullyauthenticated, the authentication entity 40 returns an authenticationtoken to the configuration application 30. Various authenticationschemes are readily known and are suitable for use in this context. Theconfiguration application 30 may then use the authentication token whileinterfacing with the distribution server 14.

The configuration application 30 may optionally query the device itresides on at 42 to learn identifying information for the device (i.e.,DeviceInfo). Exemplary identifying information may include a model ofthe device, a current model number for the device, a device type, aserial number for the device, a version number for firmware currentlyinstalled on the device as well as other identifying information. Theidentifying information is returned to the configuration application 30in response to the query. In other embodiments, identifying informationfor the device may be determined at installation and retained forsubsequent use by the configuration application 30.

To initiate a download, the configuration application 30 first queriesthe update interface at 43 for available product updates. The query willinclude identifying information for either the configuration applicationor the configuration device. The query may include information thatfurther identifies the request such as the region or geographic locationof the product. The query may also include an authentication token forauthenticating the request at the distribution server. This informationmay be used to constrain the query results. For example, a givenconfiguration application may support only certain products and thusonly a listing of updates for the supported products are provided in thequery results. Similarly, geographic location may be used to provide alisting of available product updates applicable to the geographiclocation. Since medical devices are typically regulated at a countrylevel, distribution of product updates should be controlled on a countrybasis or within some other applicable geographic area, such as countriesforming the European Union.

Upon receipt of the query, the update interface 24 would in turn querythe distribution database 26 at 44 to determine product updatesavailable to the configuration device and communicate a listing ofavailable product updates back to the configuration device in responseto the query.

Given a list of available product updates, the configuration application30 is configured to retrieve one or more product updates from thedistribution server 14. For example, the configuration application 30may scroll through the listing of available product updates. In anexemplary embodiment, product updates are segmented as packages. Thus,each entry in the listing will include a package identifier, a packagetype (e.g., software, firmware, language, document, database, etc.), anda version number for the package. Each update may further include aversion and any dependencies associated with that update version. Foreach package, the configuration application 30 may compare the versionof the package to a listing previously downloaded packages. When a morecurrent version of a package is available, the configuration application30 will make a request for an upgrade as indicated at 45.

Upon receipt of a download request from the configuration application30, the update interface 24 will query at 46 the distribution database26. In one exemplary embodiment, the update interface 24 retrieves thedata (or files) comprising the product update from the distributiondatabase 26 and forwards the product update to the configuration device16. In another embodiment, a uniform resource locator (URL) is retrievedand returned to the configuration application. The URL can then be usedby the configuration application 30 to download the product update. TheURL may be accompanied by a listing of the files in the requestedpackage, their respective sizes and signatures. Other implementationsfor downloading updates by the configuration device fall within thebroader aspects of this disclosure. In any case, the configurationapplication 30 upgrades the device at 47 with the downloaded updates.For updates pertaining to the configuration device, the upgrades may beimmediately implemented by the configuration application. On the otherhand, updates intended for medical devices 18 are stored in a data storeon the configuration device 16 and thereby made available for subsequentdownload by such devices.

Once the upgrade has been completed, the configuration application 30may verify the upgrade attempt. For example, the configurationapplication may compile a report enumerating the result of the upgradeattempt associated with the requested package. A message reporting theresult of the upgrade is then communicated at 48 from the configurationapplication 30 to the update interface 24. The confirming message may bea singular status indicator (e.g., successful or failure) and/or includethe more comprehensive report compiled by the configuration application.Lastly, the configuration application 30 will update at 49 the auditdatabase 28 with an entry regarding the download to the configurationdevice 16. Thus the audit database 28 creates a log of the updatesdownloaded to the configuration application 30, including informationidentifying the user or owner of the configuration application andinformation identifying the configuration application or the device itresides on.

Likewise, for medical devices receiving product updates, it is importantto capture information identifying these medical devices and/or theusers thereof. With continued reference to FIG. 3, each medical device18 will register itself at 33 with the configuration application 30associated with the patient's healthcare provider. Such registration isrequired before a medical device can download updates from theconfiguration application. During registration, the configurationapplication 30 will capture information that uniquely identifies themedical device (e.g., device serial number). Although not required inall embodiments, the configuration application 30 may also captureinformation that uniquely identifies the healthcare recipient or user ofthe device. This type of information may be captured by querying thedevice for such information or querying the user directly. In mostscenarios, it is noteworthy that the user of the medical device differsfrom the healthcare provider (i.e., the user of the configurationapplication). Information for the medical devices registered with agiven configuration application may be stored by the configurationapplication and/or the update interface residing at the distributionserver.

Product updates can then be distributed by the configuration device 30at 34 to registered medical devices 18. Exemplary techniques fordistributing the product updates are further described below. Uponsuccessfully distributing a product update to a given medical device, arecord of the product update is created and maintained in a transactionlog by the configuration application. This record of the product updateis communicated subsequently by the configuration application 30 at 35to the update interface 24. To the extent that identifying informationfor the given medical resides at the configuration device, suchidentifying information is appended to the record communicated to theupdate interface 24. Upon receiving the update record, the updateinterface 24 will in turn update the audit database 28 regarding theproduct update.

FIG. 6 illustrates an exemplary data model for the audit log database28. In an exemplary embodiment, the update interface 24 will create anupgrade complete log entry 68 for each product update. The primary keyof the upgrade complete log entry 68 is a unique entry ID. Each entrywill include information regarding the product update such as anidentifier for the application update, a timestamp of when the updateoccurred as well as an indication of the update result. Each entry willalso include identifying information for the configuration device(Config_Device_ID) and a user associated with the configurationapplication (Config_User) as well as identifying information for thegiven medical device (Device_ID). In some embodiments, the record mayfurther include identifying information for the user associated with thegiven medical device (Device_User_ID). Thus, an entry has been createdin the audit database 28 for each update to a given medical device. Inthe event of a product defect, the audit database 28 may be queried todetermine which devices, if any, have been affected. Furthermore, theaudit database 28 enables the update distributor (e.g., a devicemanufacturer) to contact the users of the medical devices eitherdirectly or via the healthcare provider who distributed the updates.Other implementations for the audit log database are contemplated bythis disclosure.

FIG. 7 illustrates an exemplary construct for the configuration device16. In the exemplary embodiment, the configuration device 16 includes aconfiguration application 30, a communication module 72, a distributiondata store 73, a transaction log 74 and one or more user interfacecomponents 75. More specifically, the configuration application 30 iscomprised of a download manager 76 and an update distributor 78. Thedownload manager 76 interfaces with the update interface 24 to downloadproduct updates in the manner set forth above. To do so, the downloadmanager 76 is in data communication via the communication module 72 overa telecommunication network with the update interface 24 residing on thedistribution server 14. For example, the download manager 76 may beconnected by a modem over a telephone network or a computer network(e.g., the Internet) to the distribution server 14. In another example,the download manager 76 may be connected wirelessly via a cellulartransceiver to the distribution server 14. Other types of communicationmodules and data links are contemplated by this disclosure. The downloadmanager 76 stores the product updates downloaded from the distributionserver 14 in the distribution data store 73 residing on theconfiguration device 16. In an exemplary embodiment, the distributiondata store 73 may employ a data structure similar to the data model forthe distribution database 26. In this way, the configuration device cansubsequently distribute the product updates from the data store 73 toone or more medical devices 18 while offline from the distributionserver 14.

The update distributor 78 is primarily responsible for distributingproduct updates to one or more medical devices 18. During operation, theupdate distributor 78 is configured to capture identifying informationfor the user who intends to distribute product updates to end userdevices. For example, the update distributor 78 may learn the identityof the user during a sign-in procedure. In the case of amulti-practitioner healthcare provider, the user may be one of aplurality of users authorized to use the configuration application 30.In most situations, the user of the update distributor 78 differs fromthe user associated with the medical devices 18 receiving a productupdate from the update distributor 78.

Following a product update to a device, the update distributor 78further operates to create a record for the product update in thetransaction log 74. Since product updates can occur when theconfiguration device 16 is offline (i.e., not in data communication)from the distribution server 14, the configuration application 30mandates updating the transaction log 74 for each product update. Byenforcing maintenance of a transaction log 74, the configurationapplication 30 is able to provide a record for each product update backto the distribution server 14 for audit purposes. Upon initiating datacommunication with the distribution server 14 or periodicallythereafter, the download manager 76 will upload the transaction log 74to the update interface 24 which in turn updates the audit database 28accordingly.

FIG. 8 illustrates an exemplary method for distributing product updatesfrom the configuration device 16 to one or more medical devices 18.Before product updates can be distributed, a data link must beestablished between the configuration device 16 and a target user device18. For example, communication between devices may be established usinga USB connection or some other suitable communication data link. Onceconnected, the update distributor 78 may initiate the update processautomatically or upon receipt of a command from a user.

In the exemplary embodiment, the update distributor 78 may firstauthenticate the target user device 18 as indicated at 81. Before it canreceive product updates, a medical device 18 will register itself withthe configuration application 30 as noted above. During the registrationprocess, the configuration application 30 will capture information thatuniquely identifies the medical device (e.g., device serial number).During authentication, this identifying information can be usedauthenticate the medical device 18. The authentication entity may resideon the configuration device or a separate distinct server. Whensuccessfully authenticated, the authentication entity 40 returns anauthentication token to the medical device 18. Various authenticationschemes are readily known and are suitable for use in this context. Themedical device 18 may then use the authentication token whileinterfacing with the update distributor 78.

Next, the update distributor 78 will query the medical device at 82 todetermine what packages and versions thereof reside on the medicaldevice. The medical device is configured to provide a listing of suchpackages to the update distributor 78 in response to the query.

The update distributor 78 will also query distribution data store 73 at83 to determine what product updates are available for a given medicaldevice. The query may include information that further identifies thegiven medical device such as a device type or device serial number. Thisinformation may be used to constrain the query results. For example, amedical device having the type of blood glucose meter will result in alisting of product updates that vary from those of a medical devicehaving a type of insulin pump. In response to the query, a listing ofsuitable product updates available for the given device is returned tothe update distributor 78. The update distributor 78 may further narrowthe listing of suitable product updates by comparing the version of anavailable package with the version of the package currently installed onthe given medical device. Only those packages having a more currentversion would be included in the list of suitable product updates.

The listing of suitable product updates may be presented at 84 via adisplay or some other user interface component 75 of the configurationdevice 16 to the user of the configuration application 30. Given alisting of suitable product updates, the user can then select whichproduct update, if any, to download to the end user device 18. Uponreceipt of the user selections, the update distributor 78 initiatesdownload of the product updates as indicated at 85. Alternatively, theupdate distributor 78 may forego presenting the listing of suitableproduct updates to the user and proceed to download each of the productupdates suitable for the end user device without user intervention.

To complete the download, the medical device communicates a confirmingmessage back to the update distributor 78. The confirming message mayinclude a simple status indicator, such as pass or fail, or may providea more comprehensive report regarding the installation of the productupdate on the medical device. Upon receipt of the confirming message,the update distributor 78 will update the transaction log as indicatedat 88. The entry in the transaction log will include information of theproduct updates distributed as well as information identifying themedical device receiving the product updates.

FIG. 9 illustrates an exemplary use case pertaining to medical devicesused in diabetes care. In this example, a handheld diabetes managementdevice 91 performs various tasks including measuring and recording bloodglucose levels of a patient, determining an amount of insulin to beadministered to the patient, scheduling tasks related to diabetes care,etc. In addition, the handheld diabetes management device 91 cantransmit commands over a wireless data link to an insulin pump 92 whichmay in turn selectively deliver insulin to the patient in accordancewith the commands. The handheld diabetes management device 91 may alsoreceive and process blood glucose measures from a continuous glucosemonitor 93 that senses blood glucose levels at periodic time intervalsusing a subcutaneous sensor. In these ways, the diabetes managementdevice 91 is interoperable with the insulin pump 92 and the continuousglucose monitor 93.

Given this interoperability, there may be dependencies between softwareprograms on these different devices. For example, the firmware on thecontinuous glucose meter 93 may not properly interface with an olderversion of a diabetes management software application residing on thediabetes management device 91. Similarly, the command set used by thediabetes management software application to interface with the insulinpump 92 may not be compatible with a more current version of softwareoperating on the insulin pump 92. Accordingly, the digital distributionplatform 10 should be configured to support distribution of productupdates to a requesting device taking into account dependencies withother devices which are interoperable with the requesting device.

FIG. 10 illustrates an exemplary method for distributing product updatesfrom a configuration device 16 in the digital distribution platform 10.The configuration device 16 may interface with the distribution server14 as well as one or more medical devices 18 in the manner describedabove. Although the distribution method is described as being carriedout by the configuration device 16, it is readily understood that thismethod may also be implemented on the distribution server 14 whendistributing product updates directly to the medical devices 18.

Upon receiving a request to download a product update at 101 from arequesting medical device, the configuration device 16 would firstdetermine at 102 one or more dependencies that must be met before theproduct update can be downloaded to the requesting medical device.Dependencies for a product update are defined by the publisher of theproduct update and stored in the distribution database 26 along withother information regarding the product update. When a product update isdownloaded from the distribution server 14 to the configuration device16, dependency data for each product update is likewise downloaded toand stored on the configuration device 16.

Dependency data may be stored on the configuration device 16 in thedistribution data store 73 which has a data structure similar to thedistribution database 26. Alternatively, the dependency data may bestored in a separate data file residing on the configuration device 16.An exemplary layout for this data file is set forth below.

<package> <product> Homer diabetes manager</product><type>Software</type> <value>4.0</value> <id>12345</id> <Dependencies><dependency> <product>Odysseus pump manager</product><type>Firmware</type> <value>2.0</value> <type>App-to-App</type><key>13580</key> <dependency> <dependency> <product>Penelope continuousmeter</product> <type>Software</type> <value>1.2</value><type>App-to-App</type> <key>24690</key> <dependency> <dependency><type>Region</type> <key>US</key> <dependency> </Dependencies></package>In this example, the product update package is for a product called the‘Homer diabetes manager’ which has a product type designated as‘software’. The unique identifier for this package is ‘12345’ and thepackage pertains to version 4.0 of the product. Three dependencies havebeen defined for this package. First, this product update packagerequires that a certain version of the Odysseus pump manager firmware beinstalled on the insulin pump. Second, this product update packagerequires that a certain version of the Penelope operational software beinstalled on the continuous glucose meter. Note that each of thesedependencies define an identifier <key> of the corresponding updatepackage that package ‘12345’ depends on. Such identifier can be used toretrieve additional information about the dependency from the dependencyfile. Third, this product update package is suitable for use in aparticular geographic region and thus can only be installed on arequesting device being used in the particular geographic region. Eitherof the two storage means referenced above are referred to hereingenerally as the dependency file.

Before distributing a product update, the configuration device 16 mustlearn which devices are interoperable with the requesting medicaldevice. In one exemplary embodiment, each device requesting a productupdate maintains a listing of peer devices (i.e., devices it isinteroperable with). Peer devices may be added to the listing whenever arequesting medical device pairs with or otherwise establishes acommunication link with another device. In another exemplary embodiment,the listing of peer devices may be downloaded from the distributionserver 14 to the configuration device 16. For each peer device in thelisting, the listing further includes an enumeration of software as wellas associated data files residing on a given peer device. Continuingwith the example set forth above, an exemplary layout for the listing ofpeer devices is as follows:

<Device_ID> <Model Number> <Device type>Insulin pump</device type><Products> <product>Odysseus pump manager</product><type>Firmware</type> <value>2.0</value> <product>Ulysses userinterface</product> <type>Software</type> <value>4.0</value> <Device_ID><Model Number> <Device type>Continuous glucose meter</device type><product>Penelope continuous meter</product> <type>Software</type><value>1.2</value>In this way, dependencies between devices may be verified before aproduct update is distributed to a requesting medical device.

For a requested product update, dependencies are verified by the updatedistributor 78 of the configuration device 16. To do so, a dependency isretrieved at 104 from the dependency file. The dependency is thenverified at 105. Verification of a dependency depends upon thedependency type. For example, a dependency for software specifies aversion of that software that must reside on the peer device. In asimplified embodiment, each software entity in the listing of peerdevices is checked against the retrieved dependency. When the productidentifier for the software entity in the listing matches the productidentifier for the dependency, the version of the software in thelisting is compared to the specified version of the software in thedependency. The dependency is met or satisfied when the softwareresiding on the peer device has a version as recent as the version ofsoftware specified by the dependency. In a typical versioning scheme,versions are ordered in ascending order such that any version higherthan the specified version would satisfy the dependency.

In a more robust embodiment, dependencies may specify the type of devicethe software resides on. When the software specified by a dependency isnot found in the listing of peer device for a device having a matchingdevice type, the dependency is not met.

A dependency having a region type specifies the intended geographic areaof use for the product update. To verify this dependency, the updatedistributor receives an identifier for the geographic region associatedwith the requesting medical device. In one embodiment, the identifieraccompanies the request to download a product update from the requestingdevice. When the value for the region type matches the identifier forthe geographic region, the dependency is met.

When a given dependency has been satisfied, another dependency isretrieved and verified as indicated at 108 until all of the dependenciesassociated with the product update have been verified. If a givendependency is not met, then the update distributor will proceed witherror processing as indicate at 107. In one embodiment, the productupdate is aborted and the user is notified of the compatibility issue.In this exemplary embodiment, when each of the dependencies for theproduct update has been met, the product update is distributed at 109 tothe requesting device. In other embodiments, two or more dependenciesmay be defined as OR conditions. It is readily understood that theverification procedure could be modified to accommodate such conditionsbetween dependencies.

As used herein, the term module may refer to, be part of, or include anApplication Specific Integrated Circuit (ASIC); an electronic circuit; acombinational logic circuit; a field programmable gate array (FPGA); aprocessor (shared, dedicated, or group) that executes code; othersuitable components that provide the described functionality; or acombination of some or all of the above, such as in a system-on-chip.The term module may include memory (shared, dedicated, or group) thatstores code executed by the processor.

The term code, as used above, may include software, firmware, and/ormicrocode, and may refer to programs, routines, functions, classes,and/or objects. The term shared, as used above, means that some or allcode from multiple modules may be executed using a single (shared)processor. In addition, some or all code from multiple modules may bestored by a single (shared) memory. The term group, as used above, meansthat some or all code from a single module may be executed using a groupof processors. In addition, some or all code from a single module may bestored using a group of memories.

The apparatuses and methods described herein may be implemented by oneor more computer programs executed by one or more processors. Thecomputer programs include processor-executable instructions that arestored on a non-transitory tangible computer readable medium. Thecomputer programs may also include stored data. Non-limiting examples ofthe non-transitory tangible computer readable medium are nonvolatilememory, magnetic storage, and optical storage.

The foregoing description of the embodiments has been provided forpurposes of illustration and description. It is not intended to beexhaustive or to limit the disclosure. Individual elements or featuresof a particular embodiment are generally not limited to that particularembodiment, but, where applicable, are interchangeable and can be usedin a selected embodiment, even if not specifically shown or described.The same can also be varied in many ways. Such variations are not to beregarded as a departure from the disclosure, and all such modificationsare intended to be included within the scope of the disclosure.

1. A computer-implemented system for distributing product updates,comprising: an audit database operable to store distribution data forproduct updates; an update interface is configured to distribute productupdates and maintain the distribution data in the audit database; aconfiguration device in data communication with the update interface toregister itself with the update interface and operable to downloadproduct updates from the update interface, wherein registration includesproviding identifying information for a user of the configuration deviceand identifying information for the configuration device; and a medicaldevice in data communication with the configuration device to registeritself with the configuration device and operable to download aparticular product update from the configuration device, wherein theconfiguration device creates a record of the particular product updateand communications the record of the particular product update to theupdate interface.
 2. The system of claim 1 wherein the update interfaceis configured to receive the record for the given product update fromthe configuration device and operable to update the audit databaseregarding the given product update.
 3. The system of claim 1 wherein anentry for the given product update in the audit database includesidentifying information for the configuration device, identifyinginformation for a user of the configuration device and identifyinginformation for the medical device.
 4. The system of claim 1 wherein theentry for the given product update in the audit database furtherincludes identifying information for a user associated with the medicaldevice.
 5. The system of claim 1 wherein the configuration devicequeries the update interface for latest version of a given productupdate and the update interface communicates the latest version of thegiven product update to the configuration device in response to thequery.
 6. The system of claim 5 wherein the configuration devicerequests an upgrade for the given product update and the updateinterface downloads the given product update to the configuration devicein response to the upgrade request.
 7. The system of claim 6 wherein theconfiguration device verifies download of the given product update andcommunicates a confirmation message regarding the download to the updateinterface.
 8. The system of claim 1 the configuration device operates todownload the particular product update to the medical device whileoffline from the update interface.
 9. The system of claim 8 wherein theconfiguration device creates a record of the particular product updatein a transaction log, such that the record include identifying for themedical device.
 10. A method for distributing product updates through anintermediary to end user medical devices, comprising: registering aconfiguration application residing on an intermediary configurationdevice with an update interface of a distribution server, wherein theregistration of the configuration device includes identifyinginformation for a user of the configuration device and identifyinginformation for the configuration device; downloading a product updatefrom the update interface to the configuration device; registering agiven medical device with the configuration application, wherein theregistration includes identifying information for the given medicaldevice; distributing the product update from the configuration device tothe given medical device; creating a record of the product update to themedical device at the configuration device; and communicating the recordof the product update from the configuration device to the updateinterface.
 11. The method of claim 10 further comprises receiving therecord for the product update by the update interface and updating anaudit database regarding the product update.
 12. The method of claim 10further comprises querying the update interface for latest version of agiven product update and communicating the latest version of the givenproduct update from the update interface to the configuration device inresponse to the query.
 13. The method of claim 12 further comprisesrequesting an upgrade for the given product update by the configurationapplication and downloading the given product update from the updateinterface to the configuration device in response to the upgraderequest.
 14. The method of claim 13 further comprises verifying downloadof the given product update by the configuration application andcommunicating a confirmation message regarding the download to theupdate interface from the configuration application to the updateinterface.
 15. The method of claim 11 further comprises creating anentry for the given product update in the audit database, the entryhaving identifying information for the configuration device, identifyinginformation for a user of the configuration device and identifyinginformation for the medical device.
 16. The method of claim 15 whereinthe entry for the given product update in the audit database furtherincludes identifying information for a user associated with the medicaldevice.